nginx: wrap server in http context

[gstrauss]

nginx: wrap server in http context

share most of the ssl config in the http context

[gstrauss]

Please note: it is easier to review this change if you Hide Whitespace changes.

[gstrauss]

The Intermediate config with this PR looks like:

# generated 2024-11-25, Mozilla Guideline v5.7, nginx 1.26.0, OpenSSL 1.1.1w, intermediate configuration
# http://localhost:5500/#server=nginx&version=1.26.0&config=intermediate&openssl=1.1.1w&guideline=5.7

http {

    server {
        listen 443 ssl;
        listen [::]:443 ssl;
        http2 on;

        ssl_certificate /path/to/signed_cert_plus_intermediates;
        ssl_certificate_key /path/to/private_key;
    }

    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions

    # curl http://localhost:5500/ffdhe2048.txt > /path/to/dhparam
    ssl_dhparam /path/to/dhparam;

    # intermediate configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    # verify chain of trust of OCSP response using Root CA and Intermediate certs
    ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

    # replace with the IP address of your resolver
    resolver 127.0.0.1;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
    add_header Strict-Transport-Security "max-age=63072000" always;

    server {
        listen 80 default_server;
        listen [::]:80 default_server;

        add_header Strict-Transport-Security "";
        return 301 https://$host$request_uri;
    }

}

[gstrauss]

This PR adds http context around virtual server contexts.

Out-of-scope for this PR is #124 for TLSv1.3 ciphersuites and #270 ssl_ecdh_curve. Please follow discussions there for those items.